AWS Lambda — Automate Analyzing your Permissions using IAM Access Advisor
As soon as I read about AWS IAM access advisor APIs, I knew this is something useful. Last week, we came across a use case where we wanted to get notified for all the IAM Roles with services, not accessed for more than 90 days.
- AWS Lambda — list IAM Roles with services, not accessed from more than 90 days.
- AWS SES — get notified about all IAM Roles with the list of services not accessed for the last 90 days.
🔥But, how does It work?
We’ll go through creating an AWS Lambda to automate this task using access advisor APIs provided by Python Boto3. We’ll be using following access advisor APIs:
- generate_service_last_accessed_details — generates the service last accessed data for an IAM resource (user, role, group, or policy). You need to call this API first to start a job that generates the service last accessed data for the IAM resource. This API returns a JobId that you will use for the other APIs, such as get_service_last_accessed_details, to determine the status of the job completion.
- get_service_last_accessed_details — use this to retrieve the service last accessed data for an IAM resource based on the JobID you pass in.
Let’s get started with coding!
- Create Lambda, select Python 3.x run time and Attach IAM Role
2. Get IAM Client to get service last accessed details:
Get identity and access management client
3. Get SES Client for sending email to notify:
Get simple email service client
4. Overall Lambda Function will look like this:
You’ll receive a clean email for all IAM roles like this:
Couple of things to note:
- You may need to upload the deployment package manually with the latest boto3 version instead of using AWS imported boto3 (more info: https://aws.amazon.com/premiumsupport/knowledge-center/build-python-lambda-deployment-package/)
- Recipients should be verified SES emails if we are using SES sandbox environment.
- Lambda timeout should be in minutes at least as some times it takes time for AWS to process jobs.
- Tested on Python version 3.x